cf743524a00db5d8dd45a73eb219c39411cfd57ef766299e276cf32c5f2d6563

Analysis

max time kernel
104s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4e1a2a2e59df72044e0571cfb6faa10N.exe
Size

236KB
MD5

b4e1a2a2e59df72044e0571cfb6faa10
SHA1

4b89154bfd3d0032f56d23eb1967b40256ad0b60
SHA256

cf743524a00db5d8dd45a73eb219c39411cfd57ef766299e276cf32c5f2d6563
SHA512

189f0d044b40a3c7fe25a429a31363a0c293d5d5d2e373ffe5fb496c5f98132bc4cd10e0a9a46363e642cd0672371c66b03c4491c1baaf9ea4659ddfbe4378aa
SSDEEP

3072:MJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/J/FnncroP9:QwDeM7iNEkgiOb31k1EC1J/F

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4288-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4288-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000b0000000233a8-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4e1a2a2e59df72044e0571cfb6faa10N.exe

C:\Users\Admin\AppData\Local\Temp\b4e1a2a2e59df72044e0571cfb6faa10N.exe
"C:\Users\Admin\AppData\Local\Temp\b4e1a2a2e59df72044e0571cfb6faa10N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-1PTR0EPxzXHNfSDP.exe

Filesize
236KB

MD5
2adc9facc028561f549082187faa348f

SHA1
276a2fc6be2ffc1102371bfd401778c6188d2e1b

SHA256
6953adfe79a920854ce2c5df9eeff8b4c93db1e1764767b84f5bda6a0ef0bd3b

SHA512
c906b3317a6d880c1b8202ae62cd7aa034732b1f65e3eddb213b91b1d2a4548cd19bb94aa2fc7135cfa10c70035f2548d066f006f4a8c4f0a3ecf49ec1cf5e22

Download Submit
memory/4288-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4288-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download